Data protection and chatbots – please don’t underestimate them!
Everyone knows that it is actually important, but most people often try to suppress the topic of data protection and chatbots for the time being. Basically, however, it is not difficult at all and especially when it comes to simple chatbot use cases, there are only a few basic rules to follow. The most important points are explained below. And at the end of the article there is even a podcast episode that covers the whole thing again in interview form.
What needs to be considered with chatbots when it comes to data protection?
First of all, the topic of data protection is always relevant when personal data such as name, address, contact details or cell phone number are processed. IMPORTANT: Personal data also includes the IP address. As a note, this is saved in most chatbot projects.
- First, the chatbot tool provider (e.g. aiaibot.com) and the company using the chatbot must conclude a contract. This is a so-called order processing contract. This regulates the most important rules for data processing. Topics such as the area of application of the chatbot, liability responsibilities and many more are recorded here. For example, if a company opens an account with aiaibot.com and accepts the terms and conditions, these contracts are automatically sent to the e-mail address provided. The contracts are hereby valid. These documents should be kept by both parties.
- Subsequently, the company offering the chatbot on the website or in a social media channel must inform its users about the data processing and even obtain their consent. When users visit a website, cookie banners are usually the first thing that catches their eye. These are, so to speak, the declaration of consent that cookies may be used. In most cases, it is sufficient if this consent is supplemented to the extent that the information requested in the chatbot is also listed here. The important thing is that users must actively give their consent. This means that no field may be filled in beforehand. The website user must actively press “OK”.
- Whether the classic cookie banner is sufficient for the chatbot depends on the data requested and the existing cookie banner. It is also important for chatbots that the legal framework is set up properly. This means that all data that is requested in the chatbot must be covered. If this is not the case, the cookie banner must be changed accordingly or a declaration of consent must be obtained in the chatbot. It is important that the topic of data protection is always taken into account when the chatbot is expanded or modified. In some cases, the cookie banner must also be adapted when the chatbot is modified.
And this should be considered in addition to data protection!
- Ensuring the right of the person concerned. The rights of data subjects are, in particular, the right to information and the right to erasure. Users can request the deletion of their data at any time. It is important that everyone involved is prepared and knows the internal process for deleting data immediately if a user so wishes.
- There are many great chatbot tool providers from America that are technically very good, but often do not follow the same data protection guidelines that apply in the DACH region. This is called cross-border data transfer. Countries such as the USA are not among the safe recipient countries and must therefore be mentioned separately in the standard contractual clauses.
- Particularly sensitive data, for which there are higher security standards, should be avoided in an initial chatbot project if possible. These also have to be shown separately and usually slow down the first chatbot project enormously. Hence the tip: If this data is not absolutely necessary for the business model, it should not be requested by the chatbot.
Where does the knowledge come from?
An interview with Marcel Griesinger was conducted for this article. Marcel works as a lecturer and lawyer in Germany and Switzerland. His focus is on commercial and data protection law. He is very interested in the topic of data protection because it has been one of the most important topics in commercial law since the new legislation and is of considerable importance for every company.
It is also an area of law that reflects current technical and social developments. The interface between fundamental rights and data protection on the one hand and topics such as AI, algorithms and IT services on the other is particularly exciting for Marcel.
How does a lawyer get chatbots?
On the one hand, Marcel encountered chatbots in his everyday life. As chatbots are increasingly being used, he has already gained some experience of his own with chatbots. On the other hand, of course, from a technical point of view. Chatbots and topics relating to IT law are closely connected, so Marcel inevitably comes into contact with them. Many companies are setting up a chatbot; chatbots are becoming increasingly important in marketing and customer service, for example. You have to look at how this relates to data protection law.
What makes chatbot technology so interesting?
Chatbots help to be there for the customer in an efficient way. Chatbots have a future because they bring benefits for customers and companies. Standard questions can be answered around the clock and if there are detailed questions or the conclusion of a contract, a transfer to the employee can be made.
Various data is collected via chatbots. You have to deal with questions such as “On what basis am I allowed to collect this data? What data am I allowed to process? On what basis am I allowed to process it?”. And then Marcel comes into play, he has already provided legal support for several chatbot projects.[vc_empty_space height=”40px”]
[vc_empty_space height=”40px”]And if you don’t want to miss any more podcast episodes, then sign up for the mailing list at the bottom of this page.[vc_empty_space height=”40px”]
